Security audit

Plusefin Analysis

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real PlusE financial-data skill, but it needs Review because its setup can expose an API key and it includes some broad MCP behavior beyond market-data retrieval.

Install only if you trust PlusE with your financial research queries and API usage. Prefer bearer-header or protected secret configuration over putting the API key in the MCP URL, rotate any key already used that way, and avoid enabling implicit invocation unless you want the agent to call this service automatically for finance-related prompts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: API Key Exposed Through MCP URL Query Parameter
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: plusefin.py:38
Finding: Unencoded User Input Alters Authenticated API URLs
Content: View full analysis
2 else "Error: symbol required", "price-history": lambda: request("/tools/price-history", { "ticker": sys.argv[2] if len(sys.argv) > 2 else None, "period": sys.argv[3] if len(sys.argv) > 3 else "6mo" }) if len(sys.argv) > 2 else "Error: ticker required", "fred-search": lambda: request("/tools/fred/search", { "q": sys.argv[2] if len(sys.argv) > 2 else None }) if len(sys.argv) > 2 else "Error: query required", "news-social": lambda: request("/tools/news/social", { "keywords": sys.argv[2] if len(sys.argv) > 2 else None }) if len(sys.argv) > 2 else "Error: keywords required", ``` ### Technical Analysis Values obtained from `sys.argv` are directly interpolated into URL paths or joined into query strings without URL encoding. Query values containing reserved characters such as `&`, `=`, `#`, or `?` can alter parameter boundaries or URL interpretation. Path values containing `/`, `?`, or traversal-like components can change the requested route or introduce a query string. Because the request function subsequently attaches the `PLUSEFIN_API_KEY` as a bearer token, a crafted input can cause the CLI to make an authenticated request whose path or parameters differ from the intended command semantics. The initial scheme and host are fixed to `https://mcp.plusefin.com`, so the demonstrated construction do ...[truncated 1547 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares environment and network-dependent capabilities but does not constrain tool scope with explicit permissions or allowed-tools. In an agent environment, this creates unnecessary ambiguity about what the skill may invoke, increasing the chance of over-broad tool access or unintended external calls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs agents to send user financial queries and bearer-authenticated requests to external PlusE endpoints without any user-facing disclosure about data sharing. This can expose sensitive investment interests, prompts, and API credentials to a third-party service, which is especially significant in finance-related contexts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A general-purpose calculate tool that executes Python expressions is broader than the skill's stated purpose and can become an arbitrary code execution primitive depending on the host MCP implementation. Even if intended for math, expression evaluators in Python are frequently abusable to access objects, imports, files, or system functionality unless heavily sandboxed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints, which can cause the agent to call this financial-analysis capability in situations the user did not clearly request. Because the skill can access broad financial, sentiment, macroeconomic, and prediction functionality, over-broad automatic activation increases the risk of unintended data access, misleading automated financial guidance, or prompt-surface abuse through adjacent user context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest scope is financial research and market data access through PlusE. A standalone current-time utility is a generic helper capability rather than a direct financial research function, and its presence is not explained as necessary for the skill's declared purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level docstring presents the available commands as the skill's interface, but the implemented command table also includes options-analyze and sentiment-trend, which are omitted from that documentation. This creates a mismatch between what the file claims it does and the functionality actually exposed in code.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.